Support OIDC RP-initiated logout

[jlehtoranta]

Add support for OIDC RP-initiated logout as defined in https://openid.net/specs/openid-connect-rpinitiated-1_0.html:

• Track OIDC/OAuth2 login type, tokens and authentication data on session level
• Keep session level data synced when using a login cookie (remember option)
• Handle OIDC/OAuth2 logouts on an authentication source specific endpoint
• Redirect to the OIDC end_session_endpoint, if it exists in the provider configuration
• Fallback to local logout only
• Be verbose about external logout errors
• Use a callback endpoint for maintaining state between Gitea and an OIDC provider

Fixes #14270

---

Additional notes:

• Tested with Keycloak (OIDC) and Github (OAuth2). Thorough testing with other IdPs and server setups is needed
• There are most likely some (small) merge conflicts with Support SAML authentication #29403 as these PRs modify partly the same code
• An additional PR is required for supporting OIDC back-channel (or front-channel) logout. I.e. your session in Gitea will still remain logged in, if you logout from your IdP elsewhere
• Tracking external logins on session level by using ExternalAuthTokens makes it easier to implement OIDC back-channel or front-channel logout support in the future

[lunny]

Since it's a big change for the user system, I think we need more time to discuss and have a whole design about the user system.

[jon-nfc]

Track OIDC/OAuth2 login type, tokens and authentication data on session level

if this tracking of "tokens" is the current method i.e. storing in the db, this is a major security issue (more than major if that's even possible). please take a look at the following posts I have just made after discovering this major issue which includes why it's bad and why it needs to be fixed as a matter of priority:

• Invalid oauth RefreshToken makes user become inactive when syncing users from oauth provider #34742 (comment)
• Invalid oauth RefreshToken makes user become inactive when syncing users from oauth provider #34742 (comment)

[Fuseteam]

what is the blocker for this?

[wxiaoguang]

Stale for long time, and a lot of conflicts.

Please take a look at the new PR Implements OIDC RP-Initiated Logout #36724